URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry


Host: haeum.nfile.net
Spamhaus DBL :Abused domain (malware)
SURBL :Not blocked
Quad9 :Blocked
AdGuard :Not blocked
Cloudflare :Not blocked
ProtonDNS :Blocked
OpenBLD :Blocked
DNS4EU :Not blocked
Control D HaGeZi :Not blocked
Firstseen:2019-01-28 03:26:02 UTC
Total malware sites :1
A record(s) observed :3

IP addresses


The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)IP addressHostnameSBLASNCountryActive?
2025-04-27 22:26:09 14.52.226.203Not listedAS4766 KIXS-AS-KR- KRyes
2019-04-12 07:31:11 121.166.97.236Not listedAS4766 KIXS-AS-KR- KRno
2019-01-28 03:26:07 125.131.71.94Not listedAS4766 KIXS-AS-KR- KRno

Malware URLs


The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)URLStatusTagsReporter
2019-01-28 03:26:07http://haeum.nfile.net/files/haeum.exeOnlineexe zbetcheckin

The table below shows recent payloads delivery by this host.

Firstseen (UTC)SHA256 hashFile typeBazaarSignature
2025-04-27 22:26:09a413ec38b5d2286aed07546206e1438dfc406b1f42a8c9d722cf6e3c226c7ba9exe  
2019-03-07 05:47:54807ac597a0790a85c54e3054c813528a77ccddd5d25e1d1187d5cbdf911e73bfexe  
2019-03-06 04:16:56a0f7b62809d90bcc00b02c45cbf25fc5a34d77cdf85449107cea6012986a6e16exe  
2019-03-04 04:37:147d5605adafd7e96773fd0bac70a505cdf1ff17635868f287cf67c38c2b0d2bbaexe  
2019-01-28 03:26:058709f3c69c46612a2024f3479e882e2f856fdf0164d0797301d8b6b8151f5bc9exe